Legionella water management for senior living: what the rule requires, and who owns it

If you operate a senior living community you have probably been called about Legionella, and the call probably implied that a federal rule requires you to buy something. Some of that is true and the important parts usually are not.

This article exists because the requirement is real, the misrepresentation of it is widespread, and the single most useful sentence in the actual CMS memo is the one vendors leave out.

What the requirement actually is

CMS issued a survey and certification memo, QSO-17-30, in June 2017, revised July 2018. CDC's page on the federal requirement, updated March 2024, states plainly that "CMS requires healthcare facilities develop and adhere to ASHRAE-compliant water management programs."

The memo says who it covers:

"This policy memorandum applies to Hospitals, Critical Access Hospitals (CAHs) and Long-Term Care (LTC). However, this policy memorandum is also intended to provide general awareness for all healthcare organizations."

CMS QSO-17-30, revised 07.06.2018

And what facilities are expected to have:

"CMS expects Medicare and Medicare/Medicaid certified healthcare facilities to have water management policies and procedures to reduce the risk of growth and spread of Legionella and other opportunistic pathogens in building water systems."

CMS QSO-17-30

The four things a plan must do, in CMS's own words

The memo lists a minimum. Read it as a document you produce, not equipment you install:

Notice what is not on that list: a product, a brand, a piece of equipment, or a service contract. Every one of the four is something your organization produces, owns and maintains.

The sentence vendors leave out

Immediately after that list, the memo says this:

"Note: CMS does not require water cultures for Legionella or other opportunistic water borne pathogens. Testing protocols are at the discretion of the provider."

CMS QSO-17-30

If you have been told that federal rules require you to buy Legionella water testing on a schedule, that is not what the memo says. It requires you to specify testing protocols and acceptable ranges for your control measures, and to document results and corrective actions. Whether that includes culturing for Legionella is your call.

The memo is equally specific about surveyors:

"LTC surveyors will expect that a water management plan (which includes a facility risk assessment and testing protocols) is available for review but will not cite the facility based on the specific risk assessment or testing protocols in use."

CMS QSO-17-30

So the citable failure is not having a plan, or not following your own — not choosing protocols somebody disagrees with. The memo says facilities "unable to demonstrate measures to minimize the risk" are at risk of citation for non-compliance. Demonstrate is the operative word, and it means documentation.

Does this apply to assisted living?

This is where most vendor conversations get sloppy, and it is worth being exact.

The memo applies to Medicare and Medicare/Medicaid certified facilities — hospitals, critical access hospitals, and Long-Term Care in the CMS sense, which means certified nursing facilities. Many assisted living communities are not Medicare certified, and for those the CMS requirement in this memo does not attach in the same way.

That is not the same as "it does not apply to you." The memo says it is "also intended to provide general awareness for all healthcare organizations." Beyond CMS, you may have state licensure requirements, accrediting organization standards, insurer expectations, and ordinary premises liability — and a community with an aging resident population and a large hot water system sits squarely in the risk profile the memo describes, whoever certifies it. A campus with independent living, assisted living and a certified skilled nursing wing may well have the requirement attach to part of the property and not the rest.

PROFESSIONAL CONFIRMATION REQUIRED. Which of your buildings and licenses this attaches to is a question for your counsel, your state survey agency and your accrediting organization. It is not something a water treatment company should be answering for you, and a vendor who answers it confidently on a first call is telling you something about how they sell.

Why senior living specifically

The memo gives the reason without dressing it up. Those at risk "include persons who are at least 50 years old, smokers, or those with underlying medical conditions such as chronic lung disease or immunosuppression." And on outbreak history:

"In a recent review of LD outbreaks occurring from 2000–2014 in the U.S., 19% were associated with long-term care facilities and 15% with hospitals."

CMS QSO-17-30

It is a building problem as much as a population one. Large, complex hot water systems with long runs, low-use rooms, and mixing valves that hold water in a favorable temperature band are the conditions the organism likes. Transmission, per the memo, is via aerosols — "showerheads, cooling towers, hot tubs, and decorative fountains."

That list is worth rereading if your community has a decorative fountain in the lobby.

Where a water treatment company legitimately fits

Narrowly, and underneath your program rather than in place of it.

If you do not have a plan

Start with CDC's toolkit, which the memo explicitly points to. It is free, it is the document CMS says your program should consider alongside the ASHRAE standard, and it is written to be worked through rather than admired.

Then get the right people in a room: facilities, infection prevention, and administration. The program is a cross-functional document and it fails when it is treated as a facilities task or, worse, as a purchase.

We would genuinely rather you build the program first and talk to us second, if at all. A community that calls us with a finished water management program and a specific control point to hold is a straightforward job we can do well. A community that calls us hoping to buy its way out of writing one is going to be disappointed, and should be.